Fig 3MCP Apps sandboxHover to take the next probeprobe 1 · press 0.0 px · gauge 0.0
The gauge needle, resting on zero: nothing passed the wallThe probes, pressed one at a time against the inside of the wallA study of where the HTML of an MCP App runs inside Claude.ai and what it can reach. Each probe was pressed against the sandbox boundary and stopped there: no vulnerability was found, and a runnable probe app ships with the write-up so anyone can try it again.